Public Safety Committee on Oct. 30th, 2025

[Dane Lloyd, Conservative, Parkland, AB]

I appreciate that clarification. Thank you.

I'm just wondering. We had the Privacy Commissioner here. He had been concerned about Bill C-26. He indicated that the necessity and the proportionality had been largely addressed by the introduction of a reasonableness requirement. We were told by officials from the government that the reasonableness requirement has been clearly outlined in a Supreme Court case.

Why do you think the reasonableness requirement is not suitable or not stringent enough to protect from overreach by the minister?

[Josh Dehaas]

The reasonableness requirement is important. It's a good addition to the bill.

The problem is that proposed section 15.2 states that “any threat” could result in this type of order. “Any threat” is simply not a high enough threshold. The judge would be looking at this and asking if this is a reasonable decision, based on a power that grants the minister the ability to do this type of thing based on any threat, no matter how minimal, whether serious or trifling.

[Dane Lloyd, Conservative, Parkland, AB]

Wouldn't reasonableness dictate that the response would have to be proportionate to the level of the threat, or is that not clear?

[Josh Dehaas]

It would be reasonable in regard to what is written in the provision in 15.2. A judge, later on, looking at that would ask if this was a proportional decision, based on this power, which is very broad.

Proposed subsection 15.1(2) talks about scope and substance. That's still scope and substance in relation to the provision itself. I think that adding the words “serious” and “systemic” to 15.2 would help.

[Dane Lloyd, Conservative, Parkland, AB]

I'm very interested in that amendment. I thank you for that.

We're talking about the secret orders. The department came and assured us that, in 99% of cases, there's going to be no justification for a secret order. However, in 1% of cases, the disclosure of an order would in itself lead to a threat to the telecommunications system, but you don't seem to be convinced that's a good enough safeguard.

You provided the example of a protester who is suspected of wanting to commit a denial of service attack. What reasonableness requirement would be met by the minister to put a secret order on banning that person from the Internet?

[Josh Dehaas]

I think that would be hard to justify.

I think there are occasions when a secret order would be warranted, if we're talking about national security threats from other countries or from foreign actors that want to take over parts of the system. The way it's written would allow the minister to do this and then to keep it secret for long enough, until the crisis that led to it had passed.

Think, for example, of a protester who wants to take over the Prime Minister's website through a DDOS attack. Maybe a group is planning to do this as some sort of protest. The minister could do this as punishment, without due process, and could keep that secret. We might never find out that it had occurred, so—

[Dane Lloyd, Conservative, Parkland, AB]

Although there is a notification requirement now, are you saying the notification requirement's probably not stringent enough?

[Josh Dehaas]

I'm saying that it needs to be higher, yes.

[Dane Lloyd, Conservative, Parkland, AB]

I'm going to move on.

There's been talk about encryption-breaking powers in the bill.

Mr. Shull, I didn't see anything in the bill about encryption powers, but it seems people are saying that because they're giving the power to the minister to compel the telecoms to do anything or refrain from doing anything, it could indirectly lead to encryption breaking. Did you have any comments on that?

[Aaron Shull]

It's not specifically enumerated in the bill to be able to crack encryption, but you're right that there's broad language. I suppose you could maybe find yourself there. That's why I was saying let's be crisp on the criteria.

There are bad guys doing bad things and we have to be able to stop them. We all agree on that, but under what circumstances? Let's just be crisp on the criteria that are set out so that when we get to determining whether this was reasonable, we know what yardstick we are using.

[Dane Lloyd, Conservative, Parkland, AB]

Okay.

I remember my question for Mr. Dehaas.

Let's say somebody is banned from the Internet because the government believes they're going to do an attack. I believe they have to be consulted and told by the government that they've been banned. Is that not clear?

[Josh Dehaas]

In most cases the government would and they would find out, but it's not clear to me in the bill. I think that could be clarified.

[Dane Lloyd, Conservative, Parkland, AB]

Is it itself a crime to seek judicial redress? If you feel that it's been unjustified and violates your charter rights and you go to a judge, is that a violation of the secret order? Is that criminal in itself?

[Josh Dehaas]

No, it would not be. Judicial review would always be available.

The problem here is that a layperson may not realize and they might be cowed by the fact that it's not entirely clear that they cannot seek judicial review and that it would be breaching the order. Even though judicial review is essentially always available, it should be clarified.

[Dane Lloyd, Conservative, Parkland, AB]

Thank you.

[The Chair, Liberal, Jean-Yves Duclos]

Thank you both very much.

Ms. Dandurand, you have the floor for six minutes.

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

Thank you, Mr. Chair.

I'm comparing the testimony we're hearing today with what we heard last week from expert witnesses, and I find some things a bit startling.

Mr. Dehaas, one of the things we've heard from your organization is that Bill C‑8could enable the government to disconnect Canadians from the Internet because they've criticized the government. A certain expert witness last week said that Canadians' comments as individuals absolutely don't fall within the scope of the bill. It's also being said that the bill includes concepts of proportionality and the necessity to stop an attack in order for the law to be enforced.

How do you respond to that?

[Josh Dehaas]

I think the government may, in good faith, not be particularly interested in that type of censorship. The problem is that the act does say it applies to any threat to the telecommunications system so that is very open to interpretation.

Would a court find that the act would allow this? Probably not, but the risk is that the government would do it anyway. For example, in an emergency, when tensions are heightened, this is the type of thing that can happen. That's why it's important to make it clear that these are serious threats, and that they're systemic threats to the system itself and not to individual speech.

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

Okay.

Ms. Polsky, I'm going to ask you the same kind of question. You were saying that the bill would eventually make it possible to blindly fish for information. The expert I was talking about earlier said that none of what you mentioned as a threat could be applicable. What you're worried about goes well beyond the scope of the bill, so it isn't possible for anyone to blindly fish around.

What do you have to say about that?

[Sharon Polsky]

It's important, certainly, to protect our national critical infrastructure and have provisions, but there have to be appropriate limits because the language in the law right now is vague enough, as my colleague said, that it's open to interpretation.

Without specific boundaries and without specific wrappers, what constitutes a threat? Anything can be justified. It's very easy. It's human nature we're dealing with, and if somebody feels threatened, it's easy enough to say the things that need to be said, find the evidence, make an allegation, do what you want and then leave the person to defend themselves after the fact.

That's dangerous, so there needs to be clearer language so that it's not just an open-ended opportunity.

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

The bill contains a clause that clearly defines what's considered to be a threat. That refers to what's included in the legislation. Some experts have looked into this issue.

I'm going to go to Mr. Shull.

I'd like to talk about comparisons with other jurisdictions abroad. It has been said that the European Union, the United States and Australia already have approaches to balance cybersecurity, privacy protection, transparency and oversight.

Do you think Bill C‑8 enables us to effectively comply with best practices around the world when it comes to cybersecurity?

[Aaron Shull]

I think it's a good bill. Don't get me wrong. I'm asking for some provisions to be changed because I think they could be tightened up here and there, but I absolutely think we need this bill.

I'll take a step back and say that when we're talking about privacy, we're talking about personally identifiable information. This bill is about the system itself, not just individuals. The core evil we're trying to deal with is that we're hooking up everything we possibly can to the Internet, including water systems and electrical systems. We don't really talk about OT, operational technology, but I will tell you right now that it's what the bad guys are doing. They're pre-positioning onto our critical infrastructure with a view to disabling us if we are ever in a conflict or to exert pressure. This is very bad and we have to deal with it.

The point I'm making is that I'm very supportive of this bill. It just needs some marginal tweaks to make it a bit better.

[Marianne Dandurand, Liberal, Compton—Stanstead, QC]

Thank you.

Let's go back to the comparison with other jurisdictions abroad. Are there any lessons for us to learn? Have some of them already gotten ahead? Would we be leaders if we were to implement your suggestion?

[Aaron Shull]

For sure. The closest comparisons will always be with the U.S., Australia and the U.K. We don't have a mechanism requiring critical infrastructure providers to report right now, and we have no legislative authority to require telecommunications providers to rip out bad gear. Our allies do, so we're already behind the rest of the class.

Just getting this bill passed is a step in the right direction.

[The Chair, Liberal, Jean-Yves Duclos]

Ms. Dandurand, you have a total of 15 seconds left.